If desired, Looker can perform authentication via Google OAuth, for users that have accounts registered with Google for Work.
- Organizations using Google Apps for Work can authenticate Looker users via Google accounts.
- Users log in to Looker by authenticating with their Google account.
- New Google accounts automatically get access to Looker. No need to separately invite users to Looker. You set the default role for new users, which can limit their access to functionality and data.
- When enabled, Looker authenticates users only with Google OAuth unless the “alternate login” option is selected (see further instructions below).
A user’s Google avatar appears in the navigation bar instead of the standard user symbol.
Note the following behaviors that might affect your decision to use Google OAuth:
- When enabling Google OAuth, the Looker instance can merge existing user accounts with the Google-registered domain, but only for accounts whose email address matches the domain. All other non-admin accounts will lose the ability to log in.
- All users in the specified domain get access to the Looker instance.
- Permissions for new Google users defaults to basic access for a specified list of models (which could, optionally, be access to zero models). Permissions can be updated by an admin after account creation.
- New Looker accounts that authenticate via Google OAuth cannot switch to password authentication, even if OAuth is disabled for the Looker instance.
Using Google OAuth requires the following:
- A Google Apps for Work account for the organization. The user’s Google account must have first name and last name configured for Looker to authenticate the user with Google OAuth.
- A domain controlled by the organization and registered to the Google Apps for Work account.
- Users with email addresses in the domain associated with the Google account.
Enabling Authentication with Google OAuth
Enabling authentication with Google OAuth requires an administrator to perform steps both on the Google side, and on the Looker side, as described in the following sections.
Setup on the Google Side
The steps for enabling Google OAuth on the Google side are described below. Google’s generic description of these steps are described here. Further documentation on the Google Dev Console is here.
Go to the Google API console.
Ensure that the organization field is set to your organization:
Click Create Project.
Google displays the New Project page.
Enter a specific, distinguishable name in the Project Name field:
When Google is done creating your new project, Google returns you to the Manage Resources page and shows your new project.
Click on your new project:
Google displays the IAM page:
Click the menu button (three horizontal lines) in the top left corner, and then select APIs & Services > Library:
Google displays the API library:
Find and click on the Google+ API tile:
Google displays the Google+ API enablement screen.
Google displays the Google+ API page.
In the left menu, select Credentials, and from the Create credentials drop-down menu, select OAuth client ID:
Google displays the Create client ID page.
Google requires you configure an OAuth consent screen. Click Configure consent screen. (Note, if you have configured OAuth consent for a previous project, you will not see this option, and you can skip to step 13.)
Google displays the OAuth consent screen page.
Configure your OAuth consent screen and click Save:
Google returns you to Create Client ID page.
Select Web application:
In the Name field, enter a name for your OAuth client ID:
https://. For example:
- If Looker hosts your instance:
- If you host Looker yourself (on premises):
https://looker.mycompany.comor if your Looker instance requires a port number,
In the Authorized redirect URIs field, enter the URL to your Looker instance, followed by
/oauth2callback. For example,
Google displays your client ID and your client secret:
Copy your client ID and your client secret values — you will need them to configure Looker:
Setup on the Looker Side
The steps for enabling Google OAuth on the Looker side are below.
From the Looker application, while logged in as an administrator, click the Admin button to open the Admin page.
Under the Authentication group, click Google. Looker displays the Google Authentication page:
Click Enabled to display and edit Google OAuth settings. (This does not immediately enable Google authentication; you must confirm your choice later).
Enter Google Auth Settings:
- Client ID and Client Secret - Copy and paste these values from the Google OAuth client page, as discussed in the Google setup instructions above.
Domains - Your organization’s Google-managed domain name(s). Any Google user in the given domain can log in to your Looker instance. If you control multiple Google domains you can enter them separated by commas.
WARNING: Only enter Google domains controlled by your organization. Entering any other domain could open access to users of a domain you do not control.
Enter Migration Options, which control behavior of the Looker instance during the transition to Google OAuth:
- Alternate login for admins - Lets admins continue logging in with email and password, which is a useful fall-back in case of problems setting up Google OAuth. This setting is recommended and is described further below.
- Merge by email - Converts any existing users with email addresses in the given Domains to use Google OAuth, upon their next login. This setting is recommended.
- Roles for new users - Specifies the functionality and model access that new, non-admin users have. This list can be updated later. If left blank, new Google-authenticated users will have limited functionality inside the Looker platform until an admin adds a role to their account. Since all users within your Google domain will be able to log in to Looker, consider specifying a default role for new users that limits access appropriately.
Click Test Google Authentication to use the current settings and attempt to authenticate the current browser in a new window. This action does not save the current settings or apply them to the Looker instance.
If you are not logged into Google, you are prompted to log in and asked for consent to use your Google account information. This flow uses the custom Consent screen settings you used in the Google-side setup.
Upon success, a User Info section displays with your name, email, domain, etc. Presence of this User Info section shows that this user would be successfully authenticated by Looker.
Upon failure, error descriptions appear. Below are some common issues:
- Mis-copied Client ID or Client Secret. These must be carefully copied and pasted in full.
- User is out of domain. If you see a Person Info section, but no User Info, it is probably because the user in not in the domain you specified. This shows that the person has authenticated themselves to Google correctly, but they are not using a Google account that you have chosen to allow into your Looker instance.
- Looker URL and/or redirect URL not set up correctly in Google for your Looker.
To save and apply changes, click Update.
NOTE: After you enable Google authentication, users can authenticate only through Google OAuth. If you did not enable the Merge by email setting for existing accounts, every new Google-authenticated login creates a new Looker user. Existing email/password logins are not usable at the same time that Google authentication is enabled.
To experiment with the full authentication cycle, you can logout of Google and see that Google prompts you to log in again when you attempt to log in to Looker.
In Google you can click on Account in the personal drop-down (next to your email address on the top-right of a Google Apps page) to manage your personal account.
On that management page there is a Security tab with an Account Permissions section. Clicking on Apps and websites View all lets you (as a user) see and manage the services and apps to which you have granted permissions.
Clicking on the Looker permissions that you granted in order to log on shows the details that users see in the consent screen that you customized above. You can also click Revoke access so that the next time you log in to Looker (or test authorization) you will be re-prompted with the consent screen. You can use this workflow to help you customize your consent screen and view what users will see.
Enabling E-mail Logins While Google Auth is Enabled
New Google accounts automatically get access to Looker, so there is no need to add users that are in your Google Domain.
To add a user via e-mail address that is not in your Google Domain:
- Enable the Alternate login for admins and specified users option on the Google Auth page
- Create or modify an existing user role to add the
- Go to Add Users from the users panel (/admin/users/new)
- Add the e-mail address(es) you would like to include, and the roles those users should have, which must include a role with the
- Those users are now able to log in via https://mycompany.looker.com/login/email (hidden URL)
Disabling Google Auth Once It Has Been Enabled
If you’d like to disable Google Authentication for your Looker instance after it has already been enabled, there are some things to think about:
- Users who were created before Google Authentication was added, and already setup a normal email login and password, will still function.
- Users who were created after Google Authentication was added will no longer be able to log in. While their accounts still exist, they have no way to access them, and their accounts are effectively orphaned.
This is why, currently, we suggest avoiding this route. If you must go down this path there may be a method to fix the orphaned accounts by using the Looker API. Reach out to Looker Support for additional guidance.